Fedora 18 (upgrade from 17) & tripwire reporting inode changes

asked 2013-04-09 07:02:24 -0500

jas gravatar image

I have run into a strange problem which I have not been able to track down on my own.

Recently I upgraded from Fedora 17 to Fedora 18. No problems, seamless upgrade.

While using Fedora 17, I am using Tripwrire to maintain system integrity. Each evening the machine is shut down and each morning it is powered on and a tripwire check is performed.

tripwire --check

The problem I am running into is that it reports inode modifications every morning. Example:

  Modified object name:  /usr/lib/gio/modules/giomodule.cache

  Property:            Expected                    Observed                    
  -------------        -----------                 -----------                 
* Device Number        64768                       64769

I am fully aware of the 'prelink' binary making modifications to the inode upon boot (discovered while using Fedora 17). The prelink package is NOT installed.

My only other assumption is that the ext4 filesystem, the systemd readahead service or auditd service is modifying the inode number during boot thereby rendering the tripwire integrity tool completely useless.

Any other suggestions on how to resolve or track down the offending boot service?

edit retag flag offensive close merge delete